Using Cycle-Accurate Contract Specifications for Testing Hardware Models Alexander Kamkin Institute for System Programming of RAS

Microsoft Research & Institute for System Programming of RAS Joint Workshop 2 of June, 2009 Problem Domain Hardware is designed using special-purpose languages, like Verilog and VHDL Testing of hardware models (simulation-based verification) is the main approach to hardware verification To automate simulation-based verification, formal specifications are needed What kind of specifications are good for testing of hardware models?

Microsoft Research & Institute for System Programming of RAS Joint Workshop 3 of June, 2009 Levels of Testing lui s1, 0x2779 ori s1, s1, 0xc8b9 lui s3, 0x4ee ori s3, s3, 0xf798 add v0, a0, a2 sub t1, t3, t5 add t7, s1, s3 Core-Level TestingUnit-Level Testing Model of a microprocessor is tested as a whole with the help of test programs Model of a particular unit is tested via inputs and outputs signals

Microsoft Research & Institute for System Programming of RAS Joint Workshop 4 of June, 2009 Synchronous Designs Time Clock Pulse Other Signals … … Cycle 1Cycle 2Cycle 3

Microsoft Research & Institute for System Programming of RAS Joint Workshop 5 of June, 2009 Pipelined Designs Overlapping Operation A Time Clock Pulse Execution of A Stage A 1 Stage A 2 Operation B Execution of B Stage B 2 Stage B 1 …

Microsoft Research & Institute for System Programming of RAS Joint Workshop 6 of June, 2009 Classical Contract Specifications pre(input) output = operation(input) post(intput, output) If an environment meets the precondition, then the component must guarantee the postcondition

Microsoft Research & Institute for System Programming of RAS Joint Workshop 7 of June, 2009 Cycle-Accurate Contract Specifications Operations Contracts of stages Contracts of operations A1A1 … ANAN … A1A1 … ANAN … Operation Contracts of stages Contract of operation A1A1 … ANAN pre(A, 1) post(A, 1) pre(A, N) post(A, N) … pre(A)

Microsoft Research & Institute for System Programming of RAS Joint Workshop 8 of June, 2009 Idea of the Method post(A, 2)  post(B, 1) Operation A Operation B A1A1 A2A2 …ANAN B1B1 B2B2 …BNBN Time Test Oracle 123 …

Microsoft Research & Institute for System Programming of RAS Joint Workshop 9 of June, 2009 FSM Model of Pipeline {(x, 1)}  (1) State’ = {(x i, s i ) | pre(x i, s i ) = false}  (2) {(x i, s i + 1) | pre(x i, s i ) = true  s i < L(x i )}(3) State {(x i, s i )} State’ ? Stimulus x

Microsoft Research & Institute for System Programming of RAS Joint Workshop 10 of June, 2009 FSM Transition A1A1 A2A2 …A L(A) B1B1 B2B2 …B L(B) C1C1 C2C2 …C L(C) …… D D1D1 D2D2 …D L(D) E Stimulus State

Microsoft Research & Institute for System Programming of RAS Joint Workshop 11 of June, 2009 Checking Correctness Test Oracle =  { post(x i, s i ) | pre(x i, s i ) = true }  ✕ Passed or failed? State {(x i, s i )} State’ ? Stimulus

Microsoft Research & Institute for System Programming of RAS Joint Workshop 12 of June, 2009 Test Oracle A1A1 A2A2 …A L(A) B1B1 B2B2 …B L(B) C1C1 C2C2 …C L(C) …… D D1D1 D2D2 …D L(D) E Stimulus State Test Oracle 

Microsoft Research & Institute for System Programming of RAS Joint Workshop 13 of June, 2009 A B C Branching and Other Features — stage — branch — fork — join

Microsoft Research & Institute for System Programming of RAS Joint Workshop 14 of June, 2009 Test Coverage Definition Test situations  Interesting situations for individual operations Branches of functionality  Exceptions Dependencies  Usage of shared resources Register dependencies Address dependencies

Microsoft Research & Institute for System Programming of RAS Joint Workshop 15 of June, 2009 FSM with Coverage Information x [Situation, Dependencies] Test situation Set of dependencies State {(x i [S i, D i ], s i )} State’ {…}

Microsoft Research & Institute for System Programming of RAS Joint Workshop 16 of June, 2009 Test Sequence Generation Irredundant algorithms of FSM traversal  FSM is deterministic Dependencies determine pipeline interlocks  FSM has strongly connected state graph There are no deadlocks between operations

Microsoft Research & Institute for System Programming of RAS Joint Workshop 17 of June, 2009 Irredundant Algorithms Pre State B C D ? Current State Known sub-FSM A E F ? G H

Microsoft Research & Institute for System Programming of RAS Joint Workshop 18 of June, 2009 Tool Support The approach is integrated into the CTESK tool from the UniTESK toolkit To simplify creation of specifications and tests for pipelined units using CTESK, library PIPE is developed

Microsoft Research & Institute for System Programming of RAS Joint Workshop 19 of June, 2009 Case Studies MIPS64-compatible microprocessor  TLB (translation lookaside buffer)  L2 cache (directed-mapped memory cache)

Microsoft Research & Institute for System Programming of RAS Joint Workshop 20 of June, 2009 Case Studies Summary Characteristic TLBL2 Size of implementation, lines of code Number of operations 56 Labor costs, man-months 2.54 Size of specifications and tests, lines of code Number of found bugs 104

Microsoft Research & Institute for System Programming of RAS Joint Workshop 21 of June, 2009 Future Directions SystemC and SystemVerilog languages OVM (Open Verification Methodology)

Microsoft Research & Institute for System Programming of RAS Joint Workshop 22 of June, 2009 Conclusion The contract-based approach to testing of hardware designs is introduced The approach allows to describe complex digital hardware with pipelining, interlocks, branching, etc. The approach has been successfully applied to several units of MIPS64-compatible microprocessor

Microsoft Research & Institute for System Programming of RAS Joint Workshop 23 of June, 2009 Contacts Institute for System Programming of RAS (ISPRAS) Hardware Verification ISPRAS Alexander Kamkin

Microsoft Research & Institute for System Programming of RAS Joint Workshop 24 of June, 2009 Thank You! Questions?